Case Study
TrustWallet (Binance): real-time data at wallet scale
Stakes
TrustWallet is one of the world's largest non-custodial crypto wallets, serving over 220 million users across hundreds of blockchain networks. At that scale, fraud is not a quarterly review item, it is a real-time signal. Every minute that on-chain behaviour goes unanalysed is a minute attackers can move through the system unobserved. The brief was to make on-chain transaction data, user analytics and behavioural signals queryable in seconds rather than days, and to do it without a wholesale rebuild of a data estate already measured in petabytes.
Constraints
- Many sources at once: on-chain transactions across a large number of networks, off-chain telemetry, behavioural events and third-party intelligence feeds
- A compliance-grade audit trail required for every query, every transformation and every model output
- Fraud and risk teams needed sub-minute insight on suspicious flows while product analytics needed historical depth
- One governance model had to cover teams and data sources spread across several regions
- Delivery sat inside a wider group security and compliance envelope
Approach
One governed foundation, two ways in
We designed a single governed data foundation as the source of truth for on-chain and off-chain data, shaped to serve both machine learning access for fraud and product intelligence and query-based access for analyst-led investigation, without maintaining two sets of pipelines to do it.
Layered ingestion with lineage
Raw events landed first with full lineage and an immutable audit record. Intermediate layers normalised entities, addresses and behavioural signals. Consumer-facing layers fed fraud detection, product analytics and customer-facing intelligence. Each layer carried an explicit governance contract about what it guaranteed and to whom.
Machine learning as production infrastructure
Models for fraud detection and behavioural classification were fed directly from the consumer-facing layer. Model lifecycle, evaluation and rollback were treated as first-class delivery artefacts with the same review and release discipline as any other production component, rather than as research outputs handed over at the end.
Security and compliance as foundation, not retrofit
Continuous compliance checks, encryption in transit and at rest, least-privilege access and a complete transaction history meant any auditor could trace any value back to its origin. None of this was added afterwards; it was the layer everything else was built on.
Deliverables
- Production data platform unifying on-chain, off-chain and behavioural data behind one governed surface
- Real-time fraud detection pipelines giving sub-minute insight on suspicious flows
- Machine learning platform for model training, evaluation and deployment
- Governance controls covering encryption, access, audit logging and end-to-end lineage
- Operational runbooks, incident response patterns and an on-call ownership model
- Knowledge transfer to the internal data and security teams
Outcome
TrustWallet operates a real-time fraud detection capability and a machine-learning-driven product intelligence layer on a single, governed, audit-ready data foundation. Decisions that previously took days of cross-team triage now happen inside the platform on minutes-old data, at the scale of one of the largest wallets in the world.